HCN v Penrith City Council [2026] NSWCATAD 38;

1. This is an Application for Review made under s 55 of the Privacy and Personal Information Protection Act 1998 (PPIP Act) by HCN (Applicant) on 13 June 2025 (Review Application).
2. The Applicant alleges that Penrith City Council (Respondent) engaged in conduct breaching the Applicant's privacy when the Respondent disclosed her personal information to a neighbour. The Applicant no longer presses her complaint about a photograph taken on 23 March 2023, as the Respondent has dealt with that matter.
3. The Review Application follows the Respondent's internal review decision of 19 May 2025 (Internal Review Decision) of a privacy complaint made by the Applicant on 6 February 2025 (Internal Review Application). The Respondent's Internal Review Decision declined to take further action, finding the disclosure to the neighbour exempt under s 24 of the PPIP Act. The Applicant's position is the disclosures go beyond what is permitted under the PPIP Act and are not exempt.
4. An issue in these proceedings is the scope of the Review Application before the Tribunal. The Applicant contends that the scope extends to other events and alleged breaches of the PPIP Act, while the Respondent contends that the scope is limited to the allegations of unlawful disclosure of personal information to the neighbour, raised in the Applicant's Internal Review Application of 6 February 2025.
5. For the reasons set out in this decision the Tribunal finds that the scope of the review is limited to the allegations of unlawful disclosure of personal information to the neighbour, raised in the original Internal Review Application lodged by the Applicant with the Respondent.
6. In relation to that conduct, the Tribunal affirms the decision of the Respondent. The Respondent has not breached the privacy of the Applicant because the disclosure is exempt under s 24 of the PPIP Act.
7. The Applicant had a summons issued by the Tribunal for an Officer of the Respondent to attend the hearing for cross examination. The Respondent objected to complying with the summons and on 5 September 2025 the Tribunal ordered that the summons be set aside. This decision also provides reasons for that order.

1. The Applicant relies on written submissions and made oral submissions at the hearing.
2. The following documents are relied upon by the Applicant:

(1) Administrative Review Application form filed 13 June 2025

(2) Document filed 15 July 2025 outlining alleged breaches of the PPIP Act with reference to a 149 page affidavit of the Respondent's Officer, filed in other proceedings

(3) Applicant's Submissions filed 11 August 2025

(4) Applicant's Consolidated List of Witness Questions filed 20 August 2025

(5) Applicant's Bundle of Documents handed up on 5 September 2025

(6) Applicant's note in support of summons handed up 5 September 2025.

1. The Respondent relies on written submissions and made oral submissions at the hearing.
2. The following documents are relied upon by the Respondent:

(1) Respondent's Bundle of Documents filed 4 August 2025

(2) Respondent's Supplementary Bundle of Documents filed 29 August 2025

(3) Respondent's Submissions filed 4 August 2025

(4) Respondent's Submissions in Reply filed 29 August 2025.

1. On 20 August 2025 the Applicant served a summons on the Respondent for an Officer of the Respondent to appear for cross examination at the hearing on 5 September 2025.
2. The Applicant sought to cross examine the Officer of the Respondent as the person who was directly involved "in the acts and omissions forming the basis of my privacy complaint." In her reasons for seeking the summons, the Applicant also set out other issues that she sought to cross examine on. Those other issues are unrelated to these proceedings. They are about the use of land, Council orders, code of conduct and enforcement action.
3. The Applicant contended that the summons was relevant to the issues in the proceedings. In the Applicant's submission, only the Council Officer:

"...can explain: The decision-making process behind these disclosures and selective enforcement actions. Whether he obtained lawful authority for disclosing my compliance information to third parties. Why serious and ongoing breaches by neighbouring properties were ignored. The accuracy and completeness of the information he relied upon."

1. The Applicant gave further reasons in her Note in support of the summons, including that only the Officer can give evidence on why the disclosures were made, procedural fairness considerations and that the matter is in the public interest as it raises public trust in local government compliance processes.
2. The Respondent objected to the summons on the basis that the Respondent does not dispute that the conduct the subject of the Applicant's Internal Review Application occurred, that is, that the Applicant's personal information was disclosed by an Officer of the Respondent in discussions with the Applicant's neighbour. The disclosure of information was documented in contemporaneous file notes prepared by the Officer in evidence in these proceedings. The relevant conduct of the Respondent - the disclosure of the Applicant's personal information - has therefore been identified and is not in issue in these proceedings.
3. The Respondent contends that the only real issue in dispute is the legal question as to whether the exemption for investigative agencies in s 24 of the PPIP Act applies, such that the disclosure of information did not breach s 18 of the PPIP Act.
4. The Tribunal set aside the summons on 5 September 2025 for the following reasons.
5. A summons must have a legitimate forensic purpose and be apparently relevant to the proceedings. A summons must not constitute a fishing expedition, be oppressive or an abuse of process.
6. The summons lacked legitimate forensic purpose. The evidence of the Officer's disclosures is already before the Tribunal and the issue of whether disclosures occurred is not in contention. The purpose for making the disclosures is evident from the face of the documents.
7. The questions sought to be asked by the Applicant in cross examination otherwise went to matters that are not within the scope of these proceedings. The Applicant did not demonstrate that the named Officer to whom the summons is directed is able to provide evidence relevant to the matters in issue in the proceedings.
8. In addition, the Council has not put any statement or affidavit in evidence from the Officer that warrants cross examination.
9. Therefore the Tribunal could not be satisfied there is a legitimate forensic purpose in requiring the named Officer of the Respondent to appear and give evidence in the proceedings.

1. Part 5 of the PPIP Act provides for review of certain "conduct", which under s 52 of the PPIP Act, includes the alleged contravention by a public sector agency of an Information Privacy Principle (IPP).
2. Section 53 of the PPIP Act provides for an internal review by a public sector agency. Under s 53(1) a person "who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct." The Applicant is a person who is aggrieved by the conduct of the Respondent.
3. If a person who has made an application for internal review under s 53 of the PPIP Act is not satisfied with the findings of the review or the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for an administrative review "of the conduct that was the subject of the application under section 53": s 55(1) of the PPIP Act_._
4. The Administrative Review Application was filed with the Tribunal within the 28 day statutory time frame on 13 June 2025: Civil and Administrative Tribunal Rules 2014 (NCAT Rules), s 24(4).
5. The Tribunal has jurisdiction by virtue of s 7 and 9 of the Administrative Decisions Review Act 1997 (ADR Act), ss 28 and 30 of the Civil and Administrative Tribunal Act 2013 (NCAT Act) and s 55 of the PPIP Act.
6. Under s 63 of the ADR Act the Tribunal must decide what the correct and preferable decision is having regard to the material before it.

1. The Tribunal's review jurisdiction is confined to the scope as set out in the application for internal review: FVR and FWA v Department of Education [2025] NSWCATAD 43 at [25]; Department of Education and Training v GA (No.3) [2004] NSWADTAP 50 at [7].
2. While s 53(1) of the PPIP Act should be interpreted widely to ensure that applicants are not unnecessarily denied the right to have conduct about which they are aggrieved internally or externally reviewed, an applicant's entitlement to an internal review (and ultimately an external review) depends on that person identifying the conduct about which they are aggrieved in sufficient detail to allow the agency to determine whether it constitutes a breach of an information protection principle: GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [6]- [7].
3. It is the applicant's application for internal review, reasonably construed, that set the parameters of the application. The applicant cannot, after the application has been dealt with by the agency, widen the scope of the process. It is a fundamental premise of the Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new bodies of information if they were not able to be identified (by the agency considering the complaint reasonably) at the initial stage: OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13] and [16].
4. In a complaint making specific reference to IPPs, specifying events and asserting specified breaches of the IPPs, the agency is entitled reasonably to construe the complaint as having set, by its express terms, the scope of the internal review; Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [30].

Statutory provisions - disclosure of personal information

1. Part 2 Division 1 of the PPIP Act contains "Information Protection Principles" (IPP). Information Privacy Principle 18 places limits on the disclosure of personal information. Section 18 provides:

18 Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless -

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

1. Division 3 of the PPIP Act contains specific exemptions from the IPPs. The exemption in s 24 is relevant in these proceedings. It relevantly provides:

24 Exemptions relating to investigative agencies

(1) An investigative agency is not required to comply with section 9, 10, 13, 14, 15, 18 or 19 (1) if compliance with those sections might detrimentally affect (or prevent the proper exercise of) the agency's complaint handling functions or any of its investigative functions.

...

(5) An investigative agency is not required to comply with section 18 if -

(a) the information concerned is disclosed to a complainant, and

(b) the disclosure is reasonably necessary for the purpose of -

(i) reporting the progress of an investigation into the complaint made by the complainant, or

(ii) providing the complainant with advice as to the outcome of the complaint or any action taken as a result of the complaint.

1. An "investigative agency" is defined in s 3 of the PPIP Act relevantly to mean

investigative agency means -

...

(b) any other public sector agency with investigative functions if -

(i) those functions are exercisable under the authority of an Act or statutory rule (or where that authority is necessarily implied or reasonably contemplated under an Act or statutory rule), and

(ii) the exercise of those functions may result in the agency taking or instituting disciplinary, criminal or other formal action or proceedings against a person or body under investigation, or ...

1. The Environmental Planning and Assessment Act 1979 (EP&A Act) and the Local Government Act 1993 (LGA Act) confer certain functions on the Respondent. Division 9.2 of the EP&A Act sets out the investigative powers of council Officers and defines an "investigative authority" as a council, in relation to an investigation Officer appointed by the council. An "investigation Officer" means a person appointed as such by a council.

1. In CWQ v Department of Family and Community Services [2017] NSWCATAD 252, the applicant was a tenant of the Department. A neighbour had complained about the applicant's behaviour to the Department, who later disclosed information to that neighbour about their resolution of her complaint about the tenant. The Tribunal found that the Department could claim the benefit of the s 24(5) exemption; it was an "investigative agency", because it had a statutory function under the Residential Tenancies Act 2010 to investigate complaints about its tenants, and to take formal action against its tenants, including the power to terminate a tenancy.
2. In DMR v Lane Cove Council [2024] NSWCATAD 193 at [57]- [58] found that it is incumbent upon the Council to investigate matters which are alleged to amount to a breach of the EP&A Act, and that its investigative powers extend to formal action. The Tribunal found the Council was an "investigative agency" for the purpose of s 3 of the PPIP Act.

1. In DTJ v NSW Ministry of Health [2020] NSWCATAD 65 (DTJ) the Tribunal followed the Appeal Panel's decision in ALZ v WorkCover NSW [2015] NSWCATAP 138 (ALZ), in which the Appeal Panel, in interpreting the Health Records and Information Privacy Act 2002 (Health Records Act) stated at [51] that:

"[w]hat may be seen as 'reasonably necessary' falls toward the higher end of a continuum that might be seen as having 'of some relevance' at one end and 'essential' at the other end."

1. The Tribunal in DJT held at [42] that, given the similarity and relationship between the Health Records Act and the PPIP Act, the words 'reasonably necessary' for the purposes of s 27A of the PPIP Act should have the same meaning."
2. In ALZ the Appeal Panel also said at [71]: "...it is not enough merely for the agency to make a self-serving assertion that the conduct is necessary. Its explanation must be appraised in an objective way".
3. In DMW and DMX v NSW Local Land Services [2019] CATAD 128 at [71], the Tribunal stated in the context of section 27A of the PPIP Act, which also includes the phrase "reasonably necessary" that it:

"...does not require that the provision of the Applicants' information to the Council or the LMBC was 'absolutely necessary' or 'indispensable'. Something less is required."

1. In Director General, Department of Education and Training v MT [2006] NSWCA 270; (2006) 67 NSWLR 237 at [49]- [50], the Court of Appeal held that whilst the PPIP Act is beneficial legislation "which must be liberally interpreted in order to achieve its beneficial purpose", that "does not mean that it must be interpreted in such a way that whatever may be regarded as improving its enforcement must fall within the intention of the legislature".

1. The Applicant's privacy complaint dated 6 February 2025 referred to "Breach of Privacy under Section 53 of the Privacy and Personal Information Protection Act 1998 (NSW) by discussing my fines and compliance issues with the neighbour..." Further the complaint stated that the Applicant was complaining that the Respondent's Officer "discussed my compliance matters with my neighbour ... on (27 June 2024)...". Other matters raised in the complaint relate to the Applicant's allegations of misconduct, duty of care and selective enforcement.
2. The Respondent's Internal Review Decision of 19 May 2025 relevantly summarised the relevant conduct as discussions with the neighbour in which the Respondent's Officer revealed details of investigations and compliance action taken in relation to the Applicant's property. The concerns principally relate to File Notes prepared by the Respondent's Officer dated 27 June 2024, 23 May 2022 and 10 December 2021.
3. The Administrative Review Application made by the Applicant to the Tribunal states:

"Section 24(1) does not grant a blanket exemption, there was no danger to justifying disclosure. Breach of section 18 of the PPIP Act, unsubstantiated allegations. Was made without my consent and was not lawfully authorised. I have experienced real-world harm, including anti-social behaviour / harassment as a result of inappropriate disclosure to neighbour..."

1. Attached to the Administrative Review Application is a copy of the Internal Review Decision, information on alleged abuse from the neighbour, the file note of 27 June 2024, email correspondence regarding a code of conduct complaint and a document dated 22 May 2022 titled "Meeting Invitation - Request to Include Penalty, Exempt Works, and Compensation Resolution" addressed to the Respondent. This document refers to unauthorised disclosure to the neighbour and also refers to collecting personal information unlawfully.
2. In a document filed 15 July 2025, the Applicant outlined breaches of the PPIP Act with reference to a 149 page affidavit of the Respondent's Officer, filed in other proceedings. The affidavit is not before the Tribunal. The document alleges breaches of other IPPs including IPPs 1, 5, 8, 10 and 11.
3. The Applicant's submissions of 11 August 2025 also seek to allege:

"Breach of IPP 8 - reliance on outdated, incomplete and one-sided information about my property. Breach of IPP 10 - use of my personal compliance data for an unrelated or selective enforcement purpose. Breach of IPP 11-potential disclosure of my compliance status to [neighbour], enabling targeted and vexatious complaints."

1. In summary, the Applicant seeks to construe allegations of failure by the Respondent to take enforcement action against neighbours, the manner and merits of the Respondent's investigation and enforcement activities in relation to the Applicant's land and other matters as raising breaches of IPPs.
2. At the case conference on 21 July 2025 in these proceedings, the Tribunal noted that the:

"parties note and agree that the administrative review of conduct of the respondent is confined to the first dot point of their IR scope of review - (Summary of Complaint Item, 1) concerning the alleged breaches by Council Officer...of the applicant's privacy in respect of disclosure of matters concerning her personal information to the occupier of [address]. (The applicant maintains that this includes multiple breaches of the IPPs under the PPIP Act 1998)."

1. Having regard to the decisions at [30]-[33], the Tribunal considers that the scope of this review is confined to the allegations set out in the Application for Internal Review. That application, reasonably construed, is a complaint about unlawful disclosure, specifically in relation to file notes made by the Respondent Officer following discussions with the Applicant's neighbour.
2. This is not a case where construing the scope in line with the specific allegations made by the Applicant in the Application for Internal Review would unnecessarily or unfairly deny the right to have conduct reviewed. The additional allegations of breaches of other IPPs do not arise out of a reasonable construction of the application for internal review, and in any event appear misconceived.

1. The Respondent does not dispute that its Officer disclosed the Applicant's personal information to the neighbour. The Respondent's position is that the disclosures were permitted under s 24 of the PPIP Act.
2. It is the Respondent's submission that ss 24(1) and (5) of the PPIP Act are applicable in the present case such that the Respondent was not required to comply with s 18. The Respondent contends that the conversations with the neighbour, a complainant, as recorded by the Officer in contemporaneous file notes, clearly fall within the ambit of s 24(5).
3. As to s 24(1), the Respondent's position is adherence to s 18 would have the potential to detrimentally affect (or prevent the proper exercise of) Council's complaint handling functions and investigative functions with respect to the lawfulness of the use of the Applicant's land. Disclosure of the compliance activities with respect to the Applicant's land facilitated Council's access to the neighbour's property to inspect the Applicant's property and the provision of information from the neighbour as to observed land use.
4. The Respondent provided a "Certificate of Authority" showing that the Respondent's Officer was duly appointed to carry out the powers and duties of an authorised Officer and enforcement Officer, investigation Officer and/or authorised person under the provisions of a number of Acts including the EP&A Act and the LGA.
5. The Applicant submits that the exemption in s 24 does not apply. The Applicant's submissions on this point are not clearly articulated, at times referring to phrases applicable to the exceptions in s 18 (which are not claimed by the Respondent to apply) rather than s 24 and at other times purporting to refer to the provisions of s 24 but with no reference to the requirements of those provisions.
6. The Tribunal has interpreted the Applicant's submission to be that any disclosure of her property compliance status, enforcement actions or investigation details were not authorised.

1. While the Applicant's original privacy complaint only attached the file note of 27 June 2024, the Tribunal considers that the complaint reasonably construed encompasses any disclosures of the Applicant's personal information made in the file notes to the neighbour at pages 38 to 382 of the Respondent's Bundle of Documents filed 4 August and at pages 383 (file note 10 December 2021), 384 (file note 23 May 2022) and 385-395 (file note 27 June 2024).
2. The Tribunal is satisfied that the Respondent is an "investigative agency" for the purposes of s3 of the PPIP Act, as it exercises investigative functions under the EP&A Act and LGA. The exercise of those functions may result in the Respondent taking formal action or proceedings against a person under investigation.
3. The Tribunal is also satisfied on the basis of the certification provided by the Respondent, that the Respondent's Officer who made the disclosures was authorised to exercise investigative functions under those Acts. It is evident from the documents filed in these proceedings that the Respondent's Officer was carrying out investigative functions in relation to the Applicant.
4. The exemption in s 24(1) is broadly framed. An investigative agency is not required to comply with s 18 (the disclosure IPP) if compliance "might detrimentally affect (or prevent the proper exercise of) the Respondent's complaint handling functions or any of its investigative functions."
5. Having regard to the ordinary Oxford Dictionary meaning, the threshold that compliance with s 18 "might" have a detrimental affect expresses objective possibility rather than any higher level of satisfaction.
6. The Tribunal accepts that the ability of the Respondent to properly exercise its complaint and investigative functions might be detrimentally affected in this case if the Respondent were unable to disclose certain personal information of the Applicant. The Tribunal is satisfied that the disclosures facilitated access to the neighbouring property in order to carry out investigations and respond to complaints regarding the Applicant's use of land.
7. The exemption in s 24(5) applies in relation to the personal information of the Applicant that was disclosed to the neighbour as a complainant. Applying DMW and DMX, reasonable necessity is not absolute necessity. While erring on the side of providing less personal information to a complainant assists to mitigate risk of non-compliance, it is a matter of context and degree. In this case, the disclosures made in the file notes represent an exchange of information to report on progress of investigations into complaints made by the complainant and also provides the complainant with advice on the outcome of the complaint and any action taken as a result of the complaint.

1. The scope of the Administrative Review is limited to disclosures of the Applicant's personal information to the neighbour as outlined in the original privacy complaint.
2. The disclosures of the Applicant's personal information were not unlawful as they were exempt under s 24(1) and (5) of the PPIP Act.

The decision of the Respondent to take no further action, regarding disclosures of the Applicant's personal information because the disclosures are exempt under s 24 of the PPIP Act, is affirmed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.